dan-claude-bot 44717863a1 fix: the merge door rides pushes to main — fork PR tokens are read-only ... Round-1 blocker (grok, claude on box#97's twin): a pull_request run from a public fork gets a read-only GITHUB_TOKEN — permissions: cannot raise it — and every ceremony PR this org merges is cross-repo from the bot fork, so the tag create would 403 after green asserts, red on main per release. The door now triggers on push to main (in-repo event, full token): the decide step reads the version transition from event.before (first-parent fallback for the all-zeros edge), and the release label — still the operator's declared intent — is read via the API off the merge commit's PR. A transition with no labeled PR behind it refuses. The two doors now split on the pushed ref: tags to the tag door, main to this one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-19 15:44:52 +00:00
..
scripts	feat(release): CHANGELOG.md and release.yml — a tag becomes the release it claims (#32)	2026-07-18 20:57:13 +00:00
workflows	fix: the merge door rides pushes to main — fork PR tokens are read-only	2026-07-19 15:44:52 +00:00
labeler.yml	feat: label automation — the state reconciler, path-scoped labeler, and CONTRIBUTING	2026-07-18 18:31:53 +00:00